Reliable physical unclonable function for device authentication

ABSTRACT

A method of manufacturing a secure device having a physical unclonable function includes embedding a phase change memory in the secure device, where the phase change memory includes a plurality of cells, and setting the phase change memory in a manner that results in a phase variation over the plurality of cells, wherein the phase variation is the physical unclonable function. A method for retrieving a cryptographic key from an integrated circuit, wherein the cryptographic key is stored in the integrated circuit, includes measuring a property of a phase change memory embedded in the integrated circuit, wherein the phase change memory includes a plurality of cells and the property is a function of a phase variation over the plurality of cells, deriving a signature from the property, and deriving the cryptographic key from the signature.

FIELD OF THE DISCLOSURE

The present disclosure relates to device authentication, and moreparticularly to physical unclonable functions for integrated circuits.

BACKGROUND OF THE DISCLOSURE

Hardware based “Root of Trust” is a fundamental building block for anysecure computing system. Key elements of secure computing requireauthentication, sending data to an authorized source, and/or loadingdata onto a designated device. In general, cryptographic keys in binarycode form the basis of securing data and bit streams. Typically, suchcryptographic keys are stored in non-volatile memory and are present onan integrated circuit (IC) at all times. If an attacker can extract thekey from a device, the entire foundation for secure computing is injeopardy. For example, an attacker with physical access to the devicecan delayer a chip, and read out the stored code based on the state ofthe transistors. Thus, securing cryptographic keys requires anti-tampertechnologies, which may be relatively expensive and may therefore not besuitable for implementation in various devices like field programmablegate arrays (FPGAs), mobile devices, and sensors.

SUMMARY OF THE DISCLOSURE

A method of manufacturing a secure device having a physical unclonablefunction includes embedding a phase change memory in the secure device,where the phase change memory includes a plurality of cells, and settingthe phase change memory in a manner that results in a phase variationover the plurality of cells, wherein the phase variation is the physicalunclonable function.

A method for retrieving a cryptographic key from an integrated circuit,wherein the cryptographic key is stored in the integrated circuit,includes measuring a property of a phase change memory embedded in theintegrated circuit, wherein the phase change memory includes a pluralityof cells and the property is a function of a phase variation over theplurality of cells, deriving a signature from the property, and derivingthe cryptographic key from the signature.

BRIEF DESCRIPTION OF THE DRAWINGS

The teachings of the present disclosure can be readily understood byconsidering the following detailed description in conjunction with theaccompanying drawings, in which:

FIG. 1 illustrates an exemplary device comprising an integrated circuit,according to embodiments of the present disclosure;

FIG. 2 is a graph illustrating the response of a single cell of a phasechange memory to a current pulse;

FIG. 3 illustrates the operation of an exemplary measurement circuit,according to embodiments of the present disclosure;

FIG. 4 is a flowchart of a method for manufacturing an exemplary device,according to embodiments of the present disclosure; and

FIG. 5 illustrates an exemplary graph for determining binary keys fromphysical unclonable function values.

To facilitate understanding, identical reference numerals have beenused, where possible, to designate identical elements that are common tothe Figures.

DETAILED DESCRIPTION

Embodiments of the present disclosure include secure devices havingunique physical properties, or physical unclonable functions (PUFs) forstoring secret codes used for authentication and key generation. Aphysical unclonable function comprises a set of unique analog valuesfrom structures and materials that can be measured on chip (e.g., by ameasurement circuit) followed by conversion to a code, or key, in binaryform. The present disclosure describes a set of unique materials andstructures that can be used as physical unclonable functions. Forexample, a device having a unique physical unclonable function accordingto embodiments of the present disclosure may include an integratedcircuit including a phase change memory (PCM) as an embeddednon-volatile memory. The resistance values of the individual cells ofthe PCM, which can be set at different stages between fully amorphous(i.e., high resistance) and fully crystalline (i.e., low resistance),collectively represent a physical unclonable function. As such, physicalproperties of the phase change memory can then be measured to derive asignature (e.g., by way of one or more analog response measurements),from which a binary key can be further derived.

One of the principles behind a PUF is that the cryptographic key(s) arenot stored in binary form when the chip is powered down but are hiddenin the form of unique physical analog identifiers within the hardware sothat the code can only be executed on a designated authorizeduncompromised IC. Thus, when a circuit is turned on, the structurescomprising the PUF can be measured and the analog values converted intoa binary code (or key) using an on chip measurement circuit. Forexample, a measurement circuit may be employed on chip such as thatdescribed in Suh, et al. “Physical Unclonable Functions for DeviceAuthentication and Secret Key Generation”, Proceedings of the 44^(th)Design Automation Conference, San Diego, Calif., June 2007, which isherein incorporated by reference in its entirety. However, if the chipis turned off, the binary code is not stored in any memory, but isimplicit in the properties of the chip.

Prior approaches to using physical unclonable functions forauthentication and key generation focus on device structures that havebeen optimized during manufacturing to have reduced variability, sincethe usual intent is high performance and reproducibility. However, if anarray of device(s) used to provide a physical unclonable function has anarrow variability range close to a cutoff threshold set by ameasurement device used to compute a binary code from the physicalunclonable function, any slight change over time and temperature mayresult in bit errors. The threshold set by the measurement circuit maydetermine whether to categorize various values of the signature as onesor zeros. In this way, a key, such as in the form of a binary code, canbe derived from the signature, the key comprising an identifier that isunique to the device and that can be used for authenticating the device.However, it may be a particular problem when a particular analog valueis close to a threshold. If the analog value changes even slightly, thenthe signature can change. For instance, the value can be read as a one,when it should be read as a zero. It is possible to deal with thisproblem using error correction bits. However, this may reduce thesecurity of the code because the greater redundancy and error tolerancein the code, the less reliable it is as a security mechanism.

In contrast to the foregoing, various embodiments of the presentdisclosure purposefully increase the variability in the measurablephysical properties of a phase change memory. Integrated circuits ofteninclude embedded non-volatile memory, which may take the form of phasechange memory. Phase change memory is memory formed from a material,such as chalcogenide glass, that switches between multiple states (e.g.,crystalline, amorphous, and/or other states) in response to applied heat(which may be produced by the passage of an electric current). Inparticular, the individual cells of the PCM are set to different statesor phases having varying degrees of crystallinity. The randomdistribution of different phases within the PCM results in a range ofdifferent resistivity values that can be utilized as a PUF.

In some embodiments, the variability is created by applying aprogramming pulse that sets and resets the PCM, resulting in a variable,or random, pattern of crystallinity among the cells of the PCM. In oneembodiment, the programming pulse is applied by one or more electrodesor reactive materials (e.g., contacts or photoelectric cells) connectedto the PCM. For example, in some embodiments, a current pulse between200 and 500 μA for several nanoseconds is sufficient to set or reset acell of the PCM. In other embodiments, the variability is created byperforming a laser anneal on the PCM. This induces the PCM to formvariable, or random, patterns of crystallinity. An advantage of thelaser anneal approach is that it requires less support circuitry tocharacterize and compute the PUF.

Compared to prior approaches for physical unclonable functions,embodiments of the present disclosure have a wide range/variability inmeasurable physical properties (e.g., resistance response), and providePUFs with greater reliability and with less susceptibility to biterrors. By increasing the variability of the physical properties, thelikelihood is reduced that a particular value is at or near a thresholdof a measurement device used to compute a binary code from the physicalunclonable function. Thus, even if the PUF changes due to temperature oraging, it is less likely that a binary key derived from the PUF willdrift significantly over time and temperature. The variabilityachievable through embodiments of the present disclosure is significantenough to provide a great number of unique PUFs for a wide variety ofdevices. In addition, the number of PUF values achievable' is largeenough avoid attackers guessing specific patterns.

To aid in understanding the present disclosure, FIG. 1 illustrates across-section of an exemplary device 100 (e.g., a substrate orintegrated circuit and a measurement circuit) related to embodiments ofthe present disclosure. In particular, the device 100 includes asubstrate (or die) 160 which may be comprised of crystalline silicon,gallium arsenide (GaAs), or other semiconductors, as well as othermaterials for forming transistors, resistors, capacitors, and otherstructures. Although the example of FIG. 1 refers to a die 160, thepresent disclosure is not so limited. For example, the die may be one ofmany dies (chips) that may be formed from a common wafer or substrate.Thus, embodiments of the present disclosure may incorporate a wafer orsubstrate prior to separation of multiple dies. The die 160, which formspart of the front end of the integrated circuit, may include an on chipmeasurement circuit 120 which reads one or more physical properties ofthe phase change memory (PCM) 110 used for the PUF, as described infurther detail below. The die may also include one or more electrodes150 (e.g., contacts or photoelectric cells) connected to the PCM 110 andconfigured to apply a programming pulse (i.e., current) to the PCM 110for the purposes of inducing a phase change. The backend of anintegrated circuit typically includes insulating materials, such asdielectric 130, and copper wiring formed in traces, or lines 135 whichare connected vertically by vias 140. The backend is a multi-layerinterconnect structure which includes wiring for transporting signalsbetween transistors in the front end. Also, the interconnects providesupply voltages, ground, and signals travelling off the integratedcircuit.

The PCM 110 may be any material that is capable of changing phase inresponse to the application of some stimuli (e.g., current or heat). Inone embodiment, the PCM 110 comprises chalcogenide glass. Chalcogenidegenerally includes one or more elements from group 16 of the periodictable (e.g., sulfur, selenium, tellurium). Thus, in various embodiments,a PUF may be comprised of doped Ge₂Sb₂Te₅, AsS, As₂S₃, and various otherphase change materials. In some embodiments, the resistance of regionsof the PCM 110 may be programmed to different levels. In someembodiments, described in greater detail below, variations in physicalproperties of the PCM 110 (e.g., surface structures, lattice structures,random or variable hotspots for recrystallization, etc.) can be inducedby programming pulse and/or laser anneal. These variations providemeasurable differences in the physical properties of the PCM 110 as abasis for use as a PUF. In particular, a signature and key can bederived from the PCM 110 using the measurement circuit 120 (as describedabove) or other suitable means. Similarly, in some embodiments, PCMmaterials can be deposited in vias in the backend of an integratedcircuit.

According to various embodiments of the present disclosure, the PCM 110forms the basis for a physical unclonable function. For example, in oneembodiment, the measurement circuit 120 may read one or more physicalproperties of the PCM 110 in order to determine a signature of thephysical unclonable function. For instance, the measurement circuit 120may receive measurements of various responses of the PCM 110 to astimuli (e.g., a resistance response, a voltage response, a capacitanceresponse, an impedance response, a transmittance, or the like). In theembodiment of FIG. 1, the measurement circuit 120 may measure theresponse of the PCM 110 by applying one or more signals to the PCM 110through wires in the vias 140. For instance, measurement circuitscomprising voltage controlled ring oscillators have been shown to besuitable for use in measuring PUF devices. However, in otherembodiments, different forms of on-chip measurement circuits, includingPCM-specific read circuits, may be employed. The response of the PCM 110may be considered a signature of the PCM 110 (in other words, a physicalunclonable function).

FIG. 5 illustrates an exemplary graph 500 showing a Gaussiandistribution of a number of PUF devices versus PUF values/signaturevalues (Vpuf) of the devices, and a cutoff for determining binary keys(e.g., ones and zeros) from physical unclonable function values of thePUF devices. In this case, FIG. 5 may illustrate a cutoff of 0.5 fordetermining whether a particular PUF value of a PUF device is a one or azero. The horizontal axis represents Vpuf (the PUF value, which in oneembodiment may comprise a threshold voltage, Vt, of the PUF device) andthe vertical axis represents the number of PUF devices exhibiting theparticular PUF value. For example, in a manufacturing process, an idealPUF device may have a threshold voltage of 0.5. Thus, a manufacturerwould generally prefer a yield with as many devices having a PUF valueas close to 0.5 as possible (i.e., little to no variation). However, byimplementing the purposeful variability enhancements of the presentdisclosure, a wider yield curve may be achieved where many more PUFdevices (in this case, phase change memory whose cells have been set toexhibit varying degrees of crystallinity) have PUF values greater thanor less than 0.5.

Notably, in the example of FIG. 5, the cutoff for determining whether aPUF value is a one or a zero may be 0.5. Any value measured below 0.5will be categorized as a zero whereas any value measured above 0.5 maybe categorized as a one. It should be noted that when the PUF value(Vpuf) is close to the cutoff (e.g., 0.5), changes in temperature andchanges over time may cause the PUF value to fluctuate and thereforecause a bit error in the binary key. Thus, the further the PUF value ofa particular PUF device can be made away from the cutoff, the lesslikely it is that time and temperature changes will cause the PUF valueto cross the threshold and switch from a zero to a one, or vice versa;hence, the more stable the binary key over time. In addition, althoughFIG. 5 may relate to PUF values derived from a voltage response (e.g.,threshold voltage (Vt)), in other embodiments PUF values may be derivedfrom other measureable properties, such as resistivity, capacitance,impedance or transmittance, among other things. As such, similar cutoffsmay be applied to such other values to distinguish between ones andzeros.

FIG. 2 is a graph illustrating the response of a single cell of a phasechange memory to a current pulse. In particular, the graph plots theresistance of the cell that is achieved by application of a currentpulse having a specific amplitude (y axis) and duration (x axis). Areset operation is shown between each set of data points. Asillustrated, the resistance of the cell varies greatly with theamplitude and duration of the programming pulse. As discussed above,this is because the amplitude and duration of the programming pulseresult in the cell of the phase change material being set in a certainphase (e.g., a phase that is fully amorphous, fully crystalline, oranywhere in between fully amorphous and fully crystalline). The phasedetermines the resistance of the cell. When the programming pulse isapplied to the PCM as a whole, a random distribution of phases occursover the cells, resulting in a range of different resistance values thatis unique to the PCM and that can be used as the PUF.

FIG. 3 depicts the operation of an exemplary measurement circuitaccording to various embodiments of the present disclosure. Inparticular, FIG. 3 illustrates the operation of a voltage controlledring oscillator type measurement circuit, which has been shown to besuitable for use in measuring PUF devices and presents one possible wayof measuring the PUF devices disclosed herein. However, as discussedabove, further embodiments of the invention utilize measurement circuitsthat are designed specifically for use with phase change memory, such asthe measurement circuit described by Close et al. in “A 512 MbPhase-Change Memory (PCM) in 90 nm CMOS Achieving 2b/Cell,” 2011Symposium on VLSI Circuits (VLSIC 2011), which is herein incorporated byreference in its entirety.

The measurement circuit of FIG. 3 may comprise an on-chip measurementcircuit (i.e., located within the integrated circuit itself, such as ona die of the integrated circuit as illustrated in FIG. 1) that isconfigured to measure a resistance response, a capacitance response, avoltage response, or the like of one or more PUF devices (i.e.,structures” or regions—in this case, phase change memory whose cellshave been set to exhibit varying degrees of crystallinity) comprising aphysical unclonable function. As shown in the left side of FIG. 3, ameasurement circuit 300 includes a sensing circuit 310, a voltagecontrolled oscillator 320, a divider 330 and a counter 340. In oneembodiment, the sensing circuit 310 measures one or more structures, orcells of a phase change memory (e.g., PUF1, PUF2, PUF3 . . . PUFn, asshown in FIG. 3). The response(s) of the PCM cells representing thephysical unclonable function is used by the sensing circuit to convertthe PUF values(s) into a voltage value, or values which will influencethe oscillation frequency of the voltage controlled oscillator 320. Insome embodiments, the output of the voltage controlled oscillator 320,which may be representative of the PUF value(s) of the PCM cells beingmeasured, is received by the divider 330. The divider 330 and thecounter 340 convert the signal of the voltage controlled oscillator thatis influenced by the PUF value via the sensing circuit into a digitalvalue, or binary representation. For example, the PUF value correlatesto the period, or the number of cycles/oscillations in a given time, ofthe voltage controlled oscillator signal 320. The period isobserved/determined by the counter 340 in order to decide if aparticular PUF value should be categorized as a “1” or a “0”. Thisprocess is repeated over one or more structures/PCM cells being measuredin order to create a binary set. According to various embodiments, thisbinary set (also referred to herein as a code, or key), is used as acryptographic key to authenticate a device. Notably, the code is neverstored in binary foam on the measurement device. It should also be notedthat although a binary based key is described, the present disclosure isnot so limited. Namely, other, further, and different embodiments may beincorporated in a ternary based system, and the like.

In the right side of FIG. 3, the responses of various individual PUFdevices are represented by the PUF values Vt of PUF1, Vt of PUF2, etc.,in the first column. The PUF values will influence, through the sensingcircuit 310, the number of oscillation periods produced by the voltagecontrolled oscillator 320, which will then be counted by the counter 340to determine the binary value. The threshold for distinguishing thebinary values can be set by the counter 340 counting the oscillationperiods.

One embodiment may also include a temperature sensor and circuitryimplementing a temperature compensation algorithm to account forvariations in operating temperature of the device. For example, PUFvalues may vary with respect to temperature over a range of interest.Thus, the temperature compensation algorithm may account for predictablechanges to the PUF values with respect to a stable temperaturereference. In addition, although one example of an on-chip measurementcircuit is depicted and described in connection with FIG. 3, in other,further and different embodiments a measurement circuit may be employedthat takes various other forms. For example, a measurement circuit maybe employed such as that described in Suh, et al., “Physical UnclonableFunctions for Device Authentication and Secret Key Generation”,Proceedings of the 44^(th) Design Automation Conference, San Diego,Calif., June 2007, or U.S. patent application Ser. No. 12/032,100, filedFeb. 15, 2008 (Publication No. 2009/0206821, published Aug. 20, 2009),each of which is incorporated by reference herein in its entirety.

As discussed above, the variability of the PCM crystallinity used forthe physical unclonable function can be increased by applying aprogramming pulse to the PCM. For example, in one embodiment, aprogramming pulse is applied using an electrode such as a metal contactor a photoelectric (e.g., photovoltaic) cell. For example, a programmingpulse of between approximately 200 and 500 μA can be applied for severalnanoseconds in order to set or reset a cell of the PCM. A fullyamorphous or fully crystalline phase may be achieved using a singlepulse, while a phase somewhere in between fully amorphous and fullycrystalline may be achieved using multiple pulses. For instance, a highcurrent pulse may result in a fully amorphous or near-fully-amorphousphase, while a trapezoidal pulse having a long trailing edge may resultin a fully crystalline or near-fully-crystalline phase. In oneembodiment, each programming pulse is a box-type rectangular pulse.

As an alternative, the variability of the PCM crystallinity used for thephysical unclonable function is increased using a laser anneal. Forexample, in one embodiment, a laser anneal process involves the use ofan excimer laser to induce varying degrees of crystallinity in the cellsof the PCM. The random distribution of phases in the PCM ultimatelyaffects the range of resistivity values that can be used as the PUF. Inother words, by varying the crystallinity of the PCM cells, this resultsin variations in the measurable properties of the PCM and leads to morereliable creation of the binary key/secret code value. In someembodiments, the conditions of the laser anneal can be purposefullychanged to induce variations within the PCM. For example, the excitinglaser wavelength, energy, beam width, pulse duration and other laserproperties can all be varied (e.g., from one region of semiconductingmaterial to the next).

In one embodiment, the PCM is deployed in the backend of an integratedcircuit as a physical unclonable function, thereby allowing someembodiments to include the PUF structures deployed directly atop of themeasurement circuit that generates the binary keys from the PUF values.By placing the measurement circuit and the PUF in two different layers,it makes it more difficult to probe and access the PUF than when themeasurement circuit and the PUF are on the same layer. Having themeasurement circuit sit below the PUF in the backend may further deterattacks seeking to extract signatures/keys because in order to reach thePCM, the attacker needs to separate the measurement circuit from thebackend (i.e., there is no direct access to the PUF). However, withoutthe functioning measurement circuit, the attacker will not know whichproperties to measure, which stimuli to apply, or to which regions toapply the stimuli. In addition, an attacker cannot access the PUFdirectly through the backend because there are no wiring connections tothe backside. Accordingly, such embodiments of the present disclosureprovide a tamper response. If the PUF device and the measurementdevice/support circuitry are stacked on top of each other, access isblocked from any direction. Therefore, if an attacker tries to getphysical access to a PUF signature/key by delayering, probing, or otherestablished failure analysis methods, the PUF and/or measurement circuitis altered or even destroyed in such a way as to prevent regeneration ofthe key.

FIG. 4 illustrates a flowchart of a method 400 for creating a securedevice having a physical unclonable function. In particular, exemplarysteps of the method 400 may be performed in accordance with the abovedescribed embodiments.

The method 400 begins at step 402 and proceeds to step 410 where anintegrated circuit including a non-volatile memory formed of a phasechange memory material is provided. As described above, the integratedcircuit may further comprise a front end layer formed of asemiconducting material (e.g., silicon), along with other materials, andhaving formed therein a number of transistors, gates, nets, and thelike. The integrated circuit may also comprise a number of backendlayers including a dielectric or other insulating materials, vias, andwiring connecting various elements in the front end to each other, toground, and to power sources, among other things. An exemplaryintegrated circuit is illustrated in FIG. 1 and described above.

In various embodiments, the PCM in the integrated circuit is used as aphysical unclonable function. For example, a measurement circuitembedded in the integrated circuit can determine various physicalproperties of the PCM and derive a signature and key therefrom.Accordingly, in some cases, steps 420-440 of the method 400 may beperformed following step 410. However, not all of these steps need beperformed in an exemplary process for forming a secure device inaccordance with the method 400. Thus, in some embodiments, followingstep 410 the method 400 proceeds to step 495, where the method 400 ends.However, in some embodiments, the method 400 proceeds to step 420.

At optional step 420 (illustrated in phantom), the phase change memoryis set such that each individual cell of the PCM takes on a phase thatis fully amorphous, fully crystalline, or somewhere between fullyamorphous and fully crystalline. In one embodiment, these phases arerandomly distributed among the cells of the PCM, which leads to muchvariability in the properties of the PCM and in the analog PUF value(s)of the PCM. In one embodiment, a programming pulse or a laser anneal isused to set the phases of the various PCM cells in step 420.

In optional step 430 (illustrated in phantom), at least one physicalproperty of the PCM is measured to determine a signature. Themeasurements may be performed using an on-chip measurement circuit thatis part of the integrated circuit. Specifically, in some embodiments,the measurement circuit is configured to measure/detect variousproperties of the PCM as described above in connection with theexemplary measurement circuit 300 in FIG. 3. For instance, themeasurement circuit 300 may measure the voltage response, inductanceresponse, resistance response, capacitance response, and otherproperties of the PCM in order to derive a signature therefrom. Thesignature may comprise one or more analog values reflecting the responseof a particular region of the PCM to an applied signal.

In optional step 440 (illustrated in phantom), a threshold is applied tothe signature measured in step 430 to derive a key. For example, asmentioned above, the signature of the PCM may comprise one or moreanalog waveforms representing the response(s) of the one or morestructures/regions of the PCM to applied signals. Accordingly, in oneembodiment, a signature for the PCM is derived by using a counter tocount the oscillations/period of a voltage controlled oscillator signal,or similar means. In other embodiments, a signature is derived for thePCM using a PCM-specific read circuit that measures the response of thePCM. In addition, a threshold may be applied, such as shown in theexample of FIG. 5, to derive a binary representation. In variousembodiments, the set of binary representations that is output forms akey for the integrated circuit which may be used for cryptographic andauthentication purposes, among other things. For instance, the key maybe stored in random access memory (RAM). Thereafter, a processor mayaccess the key from the RAM in order to perform various computations.Since RAM is volatile, when the device's power is shut off, the key isautomatically erased from the RAM. Every time the device/chip is turnedon, the key needs to be regenerated (e.g., by way of the method 400). Itshould be noted that although a binary based key is described, thepresent disclosure is not so limited. Namely, other, further, anddifferent embodiments may be incorporated in a ternary based system, andthe like.

At step 495, the method 400 terminates. Accordingly, the steps of themethod 400 produce a secure device comprising an integrated circuithaving a physical unclonable function (in the form of phase changememory). In some embodiments, the secure device includes a measurementcircuit for purposes of extracting a key from the properties of the PCMthat can be used for cryptographic and authentication purposes. Inaddition, although the steps of the method 400 are listed in aparticular order, as shown in FIG. 4, it should be noted that alternateembodiments of the present disclosure may implement these steps in adifferent order.

While various embodiments have been described above, it should beunderstood that they have been presented by way of example only, and notlimitation. Thus, the breadth and scope of a preferred embodiment shouldnot be limited by any of the above-described exemplary embodiments, butshould be defined only in accordance with the following claims and theirequivalents. In addition, although various embodiments which incorporatethe teachings of the present disclosure have been shown and described indetail herein, those skilled in the art can readily devise many othervaried embodiments that still incorporate these teachings.

What is claimed is:
 1. A method of manufacturing a secure device havinga physical unclonable function, the method comprising: embedding a phasechange memory in the secure device, the phase change memory comprising aplurality of cells; and setting the phase change memory in a manner thatresults in a non-uniform phase being exhibited over the plurality ofcells, wherein the non-uniform phase is manifested by at least two ofthe plurality of cells being set to different phases, wherein each ofthe different phases is one of fully amorphous, fully crystalline, orbetween fully amorphous and fully crystalline, and wherein thenon-uniform phase comprises the physical unclonable function; measuringa property of the phase change memory for deriving a signature havingone or more physical unclonable function values; and deriving a binarykey from the signature, wherein the binary key is derived by applying athreshold to the one or more physical unclonable function values forconversion into a binary code.
 2. The method of claim 1, wherein thephase change memory comprises chalcogenide glass.
 3. The method of claim1, wherein the setting comprises: performing a laser anneal on the phasechange memory.
 4. The method of claim 1, wherein the setting comprises:applying a programming pulse to the phase change memory.
 5. The methodof claim 1, wherein the property comprises collective resistivity valuesof individual cells of the plurality of cells.
 6. The method of claim 1,wherein the property of the semiconducting material is measured by ameasurement circuit.
 7. The method of claim 6, further comprising:deriving a binary key from the signature, wherein the binary key isderived by applying a threshold to the one or more physical unclonablefunction values, wherein the deriving the binary key from the signatureis performed by the measurement circuit.
 8. The method of claim 1,wherein the non-uniform phase comprises a random phase variation overthe plurality of cells.
 9. A method for retrieving a cryptographic keyfrom an integrated circuit, wherein the cryptographic key is stored inthe integrated circuit, the method comprising: measuring a property of aphase change memory embedded in the integrated circuit, wherein thephase change memory comprises a plurality of cells and the property is afunction of a non-uniform phase exhibited over the plurality of cells,wherein the non-uniform phase is manifested by at least two of theplurality of cells being set to different phases, wherein each of thedifferent phases is one of fully amorphous, fully crystalline, orbetween fully amorphous and fully crystalline; deriving a signature fromthe property, wherein the signature comprises at least one measuredvalue of the property; and deriving the cryptographic key from thesignature by applying a threshold to the at least one measured value.10. The method of claim 9, wherein the phase change memory compriseschalcogenide glass.
 11. The method of claim 9, wherein the propertycomprises a resistivity.
 12. The method of claim 9, wherein thenon-uniform phase comprises a random phase variation over the pluralityof cells.
 13. The method of claim 1, wherein the setting comprisesapplying a stimulus to the phase change memory as a whole, including allof the plurality of cells, and wherein the stimulus induces a randomdistribution of the different phases in the plurality of cells.
 14. Themethod of claim 1, wherein the random distribution is unique to thesecure device relative at least to other secure devices manufactured ina common batch with the secure device.
 15. The method of claim 1,wherein the embedding comprises deploying the phase change memory in abackend of the secure device.
 16. The method of claim 1, furthercomprising: placing a measurement circuit in the backend of the securedevice, in a separate layer from the phase change memory, wherein themeasurement circuit is configured to measure a property of the phasechange memory.